CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- webwizards marketkingMarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX7.1 High
- webwizards marketkingMarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax7.1 High
- webwizards marketkingMarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX5.3 Medium
- webwizards marketkingMarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX5.3 Medium
- mispMISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add5.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling4.5 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ OAuth credential refresh retains revoked runtime tags2.3 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access6.0 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass5.1 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check4.8 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Monitoring-tag user can DELETE shovels6.0 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Super-stream HTTP creation skips configure-permission check2.1 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: protected tag bypass via bulk-delete2.1 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure2.3 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Monitoring-tag user can restart federation links2.3 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Monitoring-tag DELETE of auth-attempt metrics2.3 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks6.3 Medium
- codexpert thumbpress – compress images, manage thumbnails, detect image issues, webp/avif, lazy loading, hotlinking & moreThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation4.3 Medium
- wpusermanager wp user manager – user profile builder & membershipWP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback4.3 Medium
- kamleshyadav handilyHandily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter5.3 Medium
- tomdever wpforo forumwpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie4.3 Medium
- rwelephant01 rw elephant rental inventoryRW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action4.3 Medium
- kamleshyadav pixelplayPixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter5.3 Medium
- kamleshyadav image buzzImage Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter5.3 Medium
- 1panel-dev maxkbMaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base5.4 Medium
- 1panel-dev maxkbMaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path5.4 Medium
- 1panel-dev maxkbMaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id4.2 Medium
- 1panel-dev maxkbMaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows5.0 Medium
- 1panel-dev maxkbMaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application5.4 Medium
- warp-tech warpgateWarpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary6.0 Medium
- warp-tech warpgateWarpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions7.7 High
- inventreeInvenTree: Report/Label print endpoints ignore per-model permissions4.3 Medium
- inventreeInvenTree: Plugin-settings GET endpoints are readable without authentication5.3 Medium
- jishenghua jsherpjshERP through 3.6 Privilege Escalation via userBusiness CRUD8.7 High
- jishenghua jsherpjshERP through 3.6 Privilege Escalation via Role Management8.7 High
- jishenghua jsherpjshERP through 3.6 Missing Authorization via systemConfig7.1 High
- jishenghua jsherpjshERP through 3.6 Missing Authorization via updateBtnStr5.3 Medium
- jishenghua jsherpjshERP through 3.6 Authorization Bypass via resetPwd8.7 High
- jishenghua jsherpjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType8.7 High
- inventreeInvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment4.3 Medium
- graylog2 graylog2-serverGraylog: Manager-to-Owner privilege escalation on saved searches and dashboards6.3 Medium
- sysadminsmedia homeboxHomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler5.4 Medium
- deepstreamio deepstream.iodeepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes8.8 High
- ajentiAjenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task9.9 Critical
- ntop ntopngntopng: Missing Authorization on System Configuration Backup Download and Listing8.8 High
- ntop ntopngntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs8.1 High
- hatchet-dev hatchetHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher3.1 Low
- mispMISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References6.3 Medium
- unknown to do list memberTo Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import3.7 Low
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint3.1 Low
- Show moreLoading…